Manage LMS Keys in a Mixed-State Environment

This section demonstrates how to use a mixed-state environment, in which multiple HSMs are used to manage the LMS Key. This example uses 2 HSMs: an nShield 5c and an nShield Connect XC.

The main difference between mixed-state environment and single-state environments is that the ASK key used by the nShield 5c must be retargeted from the seeinteg key used by the Connect XC.

Enroll both HSMs

For this example, enroll the nShield 5c as the first HSM and the nShield Connect XC as the second HSM. After enrollment, make sure the Security World is usable by both HSMs.

Set up CodeSafe

First, set up the CodeSafe environment on the Connect XC. During the nShield 5c CodeSafe setup, retarget the Connect XC seeinteg key as the simple key.

  1. Set up the Connect XC by following nShield Connect XC setup for the Connect XC.

    The Connect XC is module #2 (-m 2) in this setup.

  2. Set up the nShield 5c by following nShield 5c setup for the nShield 5c.

    When you create the simple key for the ASK, retarget the key created during the Connect XC setup. 
    generatekey -r simple

module: Module to use? (1, 2) [1] >
slot: Slot to read cards from? (0-5) [0] > 2
from-application: Source application? (seeinteg, simple) [seeinteg] >
from-ident: Source key identifier? (pqsdk-signer) [pqsdk-signer] >
ident: Key identifier? [] > pqsdk-signer
plainname: Key name? [] > simple
    Example output 
    key generation parameters:
 operation         Operation to perform     retarget
 application       Application              simple
 module            Module to use            1
 slot              Slot to read cards from  2
 verify            Verify security of key   yes
 from-application  Source application       seeinteg
 from-ident        Source key identifier    pqsdk-signer
 ident             Key identifier           pqsdk-signer
 plainname         Key name                 simple

Loading `testOCS':
 Module 1: 0 cards of 1 read
 Module 1 slot 0: Admin Card #1
 Module 1 slot 2: empty
 Module 1 slot 3: empty
 Module 1 slot 4: empty
 Module 1 slot 5: empty
 Module 1 slot 2: `testOCS' #6
 Module 1 slot 2:- passphrase supplied - reading card
Card reading complete.

Key successfully retargetted.
Path to key: /opt/nfast/kmdata/local/key_simple_pqsdk-signer

  3. Run pipsqueak to check that both HSMs are visible:

    ./pipsqueak
PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)

Test the Mixed-State Setup

In this mixed-state scenario, the first HSM (module 1) is an nShield 5c and the second HSM (module 2) is an nShield Connect XC. The HSMs have the following settings:

  • Module 1: 7852-268D-3BF9 - Slot: 2

  • Module 2: 5F08-02E0-D947 - Slot: 2

To test the setup:

  1. Format the card where the LMS key will be provisioned:

    slotinfo --format --ignoreauth -m1 -s2
Formatting token in module 1 slot 2:
Formatted token OK

  2. Check that pipsqueak works and returns results for both modules:

    ./pipsqueak

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)

Singular LMS Keys

  1. Generate a singular LMS key:

    ./pipsqueak generate alias=test-lms-78b2f8 algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Generate LMS key started: test-lms-78b2f8 (0.002 seconds)
  chunk: test-lms-78b2f8 (0.199 seconds) 4 remaining
  chunk: test-lms-78b2f8 (0.200 seconds) 3 remaining
  chunk: test-lms-78b2f8 (0.203 seconds) 2 remaining
  chunk: test-lms-78b2f8 (0.197 seconds) 1 remaining
  chunk: test-lms-78b2f8 (0.011 seconds) 0 remaining
Public key (alias: test-lms-78b2f8):
  00000005 00000004 ffc4d719 ba63ca01 2e759d65 8237177a 4f079fe8 192235ae
  c3b148c1 25073113 dfa85315 aab5079c 960b5ba2 85d65a05

  2. List the available keys:

    ./pipsqueak list
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Available Keys:
  sec-lms-3c6e64 LMS
  test-lms-78b2f8 LMS
  test-lms-28624b LMS
  test-lms-e77f9b LMS
  sec-lms-c98a6a LMS
  test-lms-dcc777 LMS
  sec-lms-8d134d LMS

  3. Create an LMS signature:

    ./pipsqueak alias=test-lms-78b2f8 message=test
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms-78b2f8):
  00000005 00000004 ffc4d719 ba63ca01 2e759d65 8237177a 4f079fe8 192235ae
  c3b148c1 25073113 dfa85315 aab5079c 960b5ba2 85d65a05
Message (test):
  74657374
Signature (alias: test-lms-78b2f8, size: 1292, time: 0.020):
  00000000 00000004 ad57253c 2eb71ee7 1d070b65 c7c48a07 ed88b378 3d6d1aef
  1f4046dc daba8ff3 0aaadf7f e726ccc3 2f757007 35b7e289 a904c1a7 b7b695da
  70101c74 b346d63d 6c6c16bf 626f6f89 4b163dc7 27e7f252 fc0b243b 515cc1b4
  0e5cd8be bcc5ed52 27e56816 88ed4770 cdb71737 3341a04c 5471b29d 29ec3d27
  4dd2ca04 91dbefdb 2200d156 d6136536 e7c4b96d 55cdbbe6 b2ea301c 236021ef
  831b1f2d 2efd7901 5f8f97c4 732306ef 0412cd65 b8cafb37 247ab7f7 6f83a416
  9c979373 bf5b5d95 7845a483 20be4426 e92c6cdb 9013c14b a0af42d7 b019ff55
  9b0d0a34 a9e4f8b9 519b24e2 8ad80fa0 ed25e283 9251a180 36e82bf5 84d3d65b
  b38986e9 50bac8f7 0f4c2b8c 253e5fd1 0384bbde 8e751aa9 02364e58 aebbea4e
  4749b8ee 5b4f2259 41404d1c 7d806867 83fe4864 405ab0f0 2086e5b0 9f4c86ca
  ffb60486 50b42dee 1dca2506 83c831dc c3a988fc 14d533f9 b2bda8c5 03ecce04
  aa4a91a1 481749d6 d4f9b9f3 ad353d31 72360d1b b12208a5 b8ae75cd 390c83ca
  5fdc899e af2d98d5 ea8632bf 654ea12b a8c6596d 17fa5216 8e50dfc9 af2230b7
  bba5beb3 ccb7fd35 688b3213 8606520f 7b490834 29096355 4fa22a46 5fd90c64
  a23d4380 f2493111 d75e0165 57b1d695 2fe3622e 9eae3314 98d8ca80 dc641752
  bca49978 65f40c88 7bfd6592 7f327c97 990f0570 91214da6 3b20a6bc dfc7092a
  a622f991 a4f906a5 8b3f3909 68aa8e22 7d9ce7a1 8a4fc8e7 ee15d79b 77b51536
  88436aef aa8235c1 b9ada358 0e01e1a5 1d3e0371 a6416096 15bf0a7d 3706fc3b
  4f2f750d 3c8b3d6c 1a308c5e 7686a50e 35eb70b1 ec920b25 346f2814 cb6fc7ca
  08884559 0bfb8853 3d08aa4b 5c980a0e bf2820e3 65661987 39638f66 3dee1f1e
  c3c4d81d aadb6fc4 77dc6cdd ad2618a0 e58e5769 11d22c78 b6730a1b 1c702bd8
  8e9eb983 36120b48 ec84bc59 1c7f5c70 22f65766 2e432634 867b0ab9 cb78267d
  d4c9990e c54cde98 706f62c1 8b795b5d 240e8ffc 9f3f813c 3864e39b 89ab56f6
  6e1e5e03 cd1d5c0b 9aec052a d5e55905 dfad70d9 aecfdcb9 1038e43b 544f3f6b
  a6a45726 c985dc29 46d83fbd 4aa370d1 ee79a2a0 063b5169 3b98298c 8d36363b
  832b73d3 f9c50646 1cc2c715 8fd258e1 a1fa1183 41a87488 e8d34976 71c0ee09
  b8ab6fc8 8437e67d 44202255 b1641eee 8d1cdff7 d230492c 86912f47 b7045b73
  8c3b09f9 2c7d1b87 9f091045 7304f18a 812e7c62 8af66ff7 fb0b4ba3 38a40e2a
  88c6afee 1ab5e19f c3afb32d c12851ed bdc395a4 9d8daa17 af0a3076 152b4334
  9652e4fe 3b0a845a be0aacdb 666cceae f98b90e2 4bb48bf8 37d301ab 75ac8af5
  cdd39a5d b803b99c 0e13b2af 46946eb6 a17abd1a 4a443a4c 0745b16b fc5da670
  7e38f81a 25abd8ec 3a665144 120ea192 284b9c22 91308953 07846cf5 29f4d1f9
  e36321a0 c065e7d0 fc14a502 987c2da2 c23dc605 af35120d 3ef84377 a3c5c071
  f34d9969 031cf75b af9db47b c7b5629c 09c79cf6 6c179854 cbc0baef 07235a58
  0982d343 e9680ca6 ec811f35 7c718783 07189a7d dcb1e3af dd60ac5a c03ca42a
  9af3a8ba 13a44351 00000005 08f7b4e8 3d91331d 7c745417 550137b9 84cde78b
  9d8f9db6 673baf8d 23c33865 b0a588ce 1a98d80d ed5223a9 2ad40b0b 082233c3
  b6d0275b aec38f4c 41c67b60 c0ae5641 1e5a6d76 0d376eb4 18530254 a305ea5f
  b7e52479 1c2697c8 f4e7b742 84f9adce b71bb5c9 fbd770ab 766f1b56 649640a1
  e3f5d7a8 ea590443 0d4fdc16 4bf153a3 8b333780 6feb2b70 444f0ada 5b38a420
  b81fa95a 2256dbef d508170c
Verify (alias: test-lms-78b2f8, time: 0.014): true

  4. Create an LMS signature for a message stored in a file:

    • Linux

      echo "hello world" > /tmp/message.txt
./pipsqueak alias=test-lms-78b2f8 msgfile=/tmp/message.txt sigfile=/tmp/message.sig

    • Windows

      mkdir c:\tmp
echo "hello world" > c:\tmp\message.txt
./pipsqueak alias=test-lms-78b2f8 msgfile=c:\tmp\message.txt sigfile=c:\tmp\message.sig
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms-78b2f8):
  00000005 00000004 ffc4d719 ba63ca01 2e759d65 8237177a 4f079fe8 192235ae
  c3b148c1 25073113 dfa85315 aab5079c 960b5ba2 85d65a05
Message (/tmp/message.txt):
  68656c6c 6f20776f 726c640a
Signature (alias test-lms-78b2f8, size: 1292, time: 0.021)
  written to /tmp/message.sig
Verify (alias: test-lms-78b2f8, time: 0.012): true

  5. Verify the signature:

    • Linux

      ./pipsqueak alias=test-lms-78b2f8 msgfile=/tmp/message.txt verify=/tmp/message.sig

    • Windows

      ./pipsqueak alias=test-lms-78b2f8 msgfile=/tmp/message.txt verify=/tmp/message.sig
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms-78b2f8):
  00000005 00000004 ffc4d719 ba63ca01 2e759d65 8237177a 4f079fe8 192235ae
  c3b148c1 25073113 dfa85315 aab5079c 960b5ba2 85d65a05
Message (/tmp/message.txt):
  68656c6c 6f20776f 726c640a
Verify (alias: test-lms-78b2f8): true

  6. Change the contents of the message.txt file and verify the signature again to confirm that verification fails.

    • Linux

      % echo "Fail Signature" >> /tmp/message.txt
% ./pipsqueak alias=test-lms-78b2f8 msgfile=/tmp/message.txt verify=/tmp/message.sig

    • Windows

      echo "Fail Signature" >> c:\tmp\message.txt
./pipsqueak alias=test-lms msgfile=c:\tmp\message.txt verify=c:\tmp\message.sig
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: test-lms-78b2f8):
  00000005 00000004 ffc4d719 ba63ca01 2e759d65 8237177a 4f079fe8 192235ae
  c3b148c1 25073113 dfa85315 aab5079c 960b5ba2 85d65a05
2026-02-24T16:35:48 lms_public_verify[hsslms.c:2463] VerifyFailed(11): expected 4f079fe8:192235ae:c3b148c1:25073113:dfa85315:aab5079c:960b5ba2:85d65a05 but computed 80be279a:69c5c69e:bcb908ba:fe177958:08cc234d:2af11f34:d5b521b7:0dd3e48b
ERROR: verify failed

  7. Check how many signatures remain:

    ./pipsqueak showinfo alias=test-lms-78b2f8

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
  7852-268D-3BF9
  - Slot 2: ic=13 blank
  5F08-02E0-D947
Alias: test-lms-78b2f8
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 30 signatures
Public key (alias: test-lms-78b2f8):
  00000005 00000004 ffc4d719 ba63ca01 2e759d65 8237177a 4f079fe8 192235ae
  c3b148c1 25073113 dfa85315 aab5079c 960b5ba2 85d65a05

Sectorized LMS Keys

  1. Check that the sum of explease and expcard does not exceed the height.

    The following command should fail because the sum of explease (3) and expcard (4) is greater than the height (5):

    ./pipsqueak generate alias=sec-lms-def0cc algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=4 explease=3

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Generate LMS key started: sec-lms-def0cc (0.002 seconds)
2026-02-24T16:35:48 continueLMS_cache_next[see-commands.c:532] InvalidParameter(24): private key tree height is less than the sum of card and lease exponents (5 < 4 + 3) in continueLMS_cache_next
ERROR: continueLMS failed on chunk
LMS key requires 16 cards

  2. Create a sectorized LMS key using pipsqueak generate.
    A blank card must be presented to create a sectorized LMS key.

    For example, to configure an LMS key as one card, two uses, and 16 signatures:

    ./pipsqueak generate alias=sec-lms-def0cc algorithm=lms lmscode=sha256_m32_h5 lmotscode=sha256_n32_w8 expcards=0 explease=1
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Generate LMS key started: sec-lms-def0cc (0.002 seconds)
  chunk: sec-lms-def0cc (0.200 seconds) 4 remaining
  chunk: sec-lms-def0cc (0.199 seconds) 3 remaining
  chunk: sec-lms-def0cc (0.197 seconds) 2 remaining
  chunk: sec-lms-def0cc (0.207 seconds) 1 remaining
  chunk: sec-lms-def0cc (0.002 seconds) 0 remaining
LMS key requires 1 card
Attempting to write to card in slot 2...
Card processed (0 remaining)
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35

    If you attempt to create a signature now, the operation fails because you must first provision the key from the card to the HSM.

    ./pipsqueak alias=sec-lms-def0cc message=test

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35
2026-02-24T11:26:41 dispatch_see_nvmemfile[dispatch.c:837] NotAvailable(73): no HSMs with NVRAM 6c6d731e:f370308b:8688f7 file
ERROR: sign failed

  3. Provision the key from the card to the HSM:

    ./pipsqueak provesn=7852-268D-3BF9 slot=2

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Attempting to provision 7852-268D-3BF9 from slot 2...
Provision successful.

  4. Check how many signatures remain:

    ./pipsqueak showinfo alias=sec-lms-def0cc

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
  7852-268D-3BF9
  - Slot 2: ic=13 lms
  5F08-02E0-D947
Alias: sec-lms-def0cc
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 16 signatures
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35

  5. Create an LMS signature.

    You can do this 16 times before needing to provision again.

    ./pipsqueak alias=sec-lms-def0cc message=test
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35
Message (test):
  74657374
Signature (alias: sec-lms-def0cc, size: 1292, time: 0.020):
  00000000 00000004 948ddb4a 8381238e 6a579c13 e5c78a26 42fb4953 867aec18
  3969c380 0fc1f97f 2cde9765 b63e1ee1 ad9d2008 487239b2 f16dc501 227b74db
  f115341c a1f6add1 6c961cad 5dd8d294 7fd08115 0b04d8b4 e1587f91 ba2c59fd
  6a2db924 87d6f5df 1d7e1dff cfcf599c bc64f138 9808fd36 f21de8c4 b1513da9
  711f2e4e 40ba9828 337e2ef7 09c3cc40 699190fd eec808d1 35f5bc60 9ec4dedc
  62945804 7e529ccc a98ecae0 c10b4791 1fe3b23f 009fe02a f14f486f 267f7c23
  9fcce888 a1dca9c1 9c77891a aa7b163c edc0f48a 2ff90407 35264425 bf6559a8
  f2793316 99a8d2d7 9db383be 9571b8ee 23626967 ef3d21b9 0108eb63 f8058b61
  ed50755b 69b6cdeb b56d2863 ab2c968b d9241d13 c2d8123f 16c723e1 c866401f
  f436ae04 1572188a 05be22ab 80ed4983 8692cee4 3fcd8b68 91ba8d85 64f4b8e2
  3d3db884 4038695c fedfeeb9 60b6976f 5ecb89f4 85217db1 a6a7e4b9 cdd29d10
  4aeaf91e 77df74a7 654f01f2 5123b1fc b17687a9 deca941f 6b785541 23ab7539
  a3cbde83 bf911077 e960bc6f 25a6e9e1 d5e7402c bcd58cd6 89149061 d47b598d
  99cbcb24 b8bed1ed 69896fcf 901dc451 d5d090e2 7d9b12cb 2a41f42c fc538034
  d0c77eb6 0c6bc8e1 fafb2276 5f167785 ba9d1a73 c626eaae c3a8dd06 924f2d18
  0b9ffaf9 af356ee1 b61a2ef6 a4bdeea2 f57aa60a 05281ded 93d6e381 8a1950f3
  0dd8aa39 4d19b6f8 a53bd4ab 3f06524c 8170bce6 c4e4aeb6 6710373d 7a27c77b
  1c599d9a 368faa81 7c715d57 4254529d 5624d471 d2914767 475a02d4 94e34a8f
  6d2caa74 fa3c04e8 7e5d85fd 6350ae8c 6c370703 8651c751 2e03bbb5 86475a4f
  9b0f1052 a7e3b4da 424034a2 8eefafa9 695a2e5d 556087c1 79100bf8 c3be152b
  b7bf1c40 075bb1b3 44ad9146 7d7bc042 a5fca7b6 54a591b6 6cda67bc cacc6e38
  c49056d5 4f30ca5c 82b1255e 6d8cbc72 7f150178 61c182b8 11300f69 bb1a638f
  89938dd0 c2aaa78a 15617f0a 8fd15f78 78c51440 feda9e7f dcde2942 d1b6f59b
  e9de1960 3100115e 9027eb7a 7d99c874 4950ad86 29acfce9 c70fa7e4 73918010
  8ca77bea 4d9c9b8f 1d549885 fc676750 9b32cc20 1519d7e6 73b7c9ab 7bab1fc3
  8e32f22c da15a9c2 54dbc82f 08e8eed3 1538847d 7bb0dd0d 867176be f53eb25a
  ba8d5edd b3a83589 836dc0ae 51c9fe8b 6dcdeb67 44afd958 75655355 64fc5b7e
  27a7c726 56050ff9 68b2a24a 0028de0c 37b3f42c 8184a493 96439a54 bf8b96e5
  777c0b92 f636df8f 3241b3e7 5d824671 7fd4fdcf 6da3f535 45cd502c 9f362cce
  8ed0d379 a2d11a98 13371b39 ae6fa58b 12e6b058 5c3864c1 037db52d c876f60a
  054d0134 4d1658e7 43209a64 f7cddb93 7f8e7e1a 949542c5 38503815 9237090f
  eab5063e ba5ca970 32c6901a 3d583105 5a960cdb 1b721cf7 7030c3ee 94064e4e
  ae73189a 2972cf82 e8fe485e b6ac21f2 1e63939b b53bc723 c5272d8b f927e659
  3fa97648 f276fbad 22d3990e 7ece8fc4 5b8d76df 6a4715a6 0e28476f 7192aecc
  f726a121 d8ca7778 11c29e75 d095c274 86210a80 c6ab0051 35fc6cb0 04c981e0
  01940181 717107f1 00000005 9e671d09 fe3ba52f f9fc57bd 31270480 3242375e
  56e0ef3e ad17bb40 3f24437d 863cc431 4eb2cab6 022cac64 6701fbe9 8f85d928
  3897d3bd aa17efa7 8cec8438 1510974c ad689517 2333ab90 4bcd2772 2782ea40
  05b9cf44 a079101f 8ee08ba9 d605830f 1b1c89ef 2957bc36 4b54cde4 3ca8ca7d
  cd39268b e1a722c1 583a7be3 77342141 77f591ed 44040420 fcaae51f 60378c93
  920b7d36 99448634 56a3f517
Verify (alias: sec-lms-def0cc, time: 0.013): true

  6. Check how many signatures remain.

    After signing 16 times, showinfo will show that there are no remaining signatures:

    ./pipsqueak showinfo alias=sec-lms-def0cc

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
  7852-268D-3BF9
  - Slot 2: ic=13 lms
  5F08-02E0-D947
Alias: sec-lms-def0cc
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 0 signatures
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35

    If you try to sign again, you will get an error.

    ./pipsqueak alias=sec-lms-def0cc message=test

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35
2026-02-24T11:27:06 dispatch_see_nvmemfile[dispatch.c:837] NotAvailable(73): no HSMs with NVRAM 6c6d731e:f370308b:8688f7 file
ERROR: sign failed

  7. Present the card to the second HSM to provision it:

    ./pipsqueak provesn=5F08-02E0-D947 slot=2

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Attempting to provision 5F08-02E0-D947 from slot 2...
Provision successful.#

  8. Run showinfo again to check that there are 16 signatures available.

    ./pipsqueak showinfo alias=sec-lms-def0cc

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
  7852-268D-3BF9
  5F08-02E0-D947
  - Slot 2: ic=13 lms
Alias: sec-lms-def0cc
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 16 signatures
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35

  9. Sign 16 more times until all signatures are used.

    ./pipsqueak alias=sec-lms-def0cc message=test
    Example output 
    PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35
Message (test):
  74657374
Signature (alias: sec-lms-def0cc, size: 1292, time: 0.025):
  00000010 00000004 116798bf 26fdd928 0d6983b6 085e4787 39367eef 3b276c63
  8ba0ac83 a82b857e 9647cd3b 83451492 191f0c5d 1a7ccee0 ac0aa00f 51e8e2f4
  bb3c7476 21559b13 8681f55f 707baa33 57b4e6a9 16876ea5 00997f03 7f92a387
  2ae77660 410e9102 f306e44c 71b43f15 c10d8ca3 ef2bc15e 99006a24 4f70800d
  9f08b92b 43214120 7240d518 ff38a9d4 2631c51d fa063d71 b67ccd92 9faa257e
  c95343bc adec959e c42641be 7801280b e621a22f afb480cb 0046f733 0a609caf
  621e22de 446269f7 59238cd6 6c230a40 2f21bd69 0cb61e92 9f91c7fe e174faa7
  42fe74b1 d8b04695 94b0e006 fc7780fc 8b13d073 5f82b01a 3ce70852 49299d3c
  de87dbfd ab24a5d7 08b23d6c 87299298 94698dcc f1d5d413 4cfaed83 5e582b9c
  f3324388 4080c5ef e4e50d9c b5f340e9 afca45de a09945c9 2becfcb9 16aca544
  cc8a0e25 6ee9ca86 a1ffad5e c5e76d5f 657f71b1 84c1f0f3 b74ed796 9df17463
  19b8729d 7a583c68 c6f6d111 a963ba90 534ae294 f61cc4a8 156e3dab 2be05be5
  5fdb7dce 77c2ca10 e14b29f5 bde90f6b a4772a73 5eb69f5f 803d6d70 cf147494
  7b4ebdf3 00630b72 cde20cf3 3322f475 765e659e f791f102 d0d16bd0 05e2df67
  e06e9cbb b0d20d36 6d3f2c67 97430ef6 347623ca 1e4ea554 5b5e31a5 86eefca6
  9fce4011 7816d617 bd090935 4ba14651 1688af72 ea4eb515 f68d96a1 fb56c183
  e770e634 6489015e 7990a4d0 cc0c5369 f6e82810 82fd25b1 c117c9b4 efea6492
  58f7118a 1af50d54 b623ff6a c6be9745 bda0c0ef c2b825bb 672e9115 50c4b657
  62ad50d0 ee79b79d ee93c78c 43a02a23 d7b008ee 93dfb87a e8776e15 534f5168
  20649bbf a4a1ca03 d74038ad 710d2d95 57ea03a1 b3e70bbc b0a373f0 2747fcc3
  f9657d9f 5e2d73fa c88cd5f7 e0e1187f 966fc4df 1042d61a 3f2615b2 117556ca
  24169a3f 125e38d8 2a9907a8 8fc843db a88452bb 8042a34a cffda58d b9a7d352
  8e1c62c6 9b6616e1 171e1592 7cb5c237 0409fccd f4cb7842 d41f19e3 4ff4a3cf
  45dec48b 99d0799b 4f3226a1 3706197c 3c069b4f 492d31b2 7f852081 7efc84ca
  56cda44a c9f5560f 5677a38e 40ec1749 4e10588d 387cf3bf ad4a30b8 0c8c70a7
  27710184 073715e6 900873c4 3bdbe68d 6060c032 a1da8446 e8705b44 c8509c23
  a42e0ba2 758e273a 242675c2 c868ed41 f4780582 c7dae642 c42cfc68 ee9003c2
  3739cadc 0a226f63 27c95803 0f9d710b 846a144a 65c96588 d9d92f32 bc980c76
  3b81e6bc 61945a51 1c790678 61a4e56d a036b940 9fb1ec03 ae0c5c9f 5bd59c99
  9f312dbf 1ec00568 de8f9f74 1bfe9585 4572cffb 5d77edd7 75701328 113c69ef
  64292073 cc1bf195 27581487 0195329f 1f5e3b67 419c0108 a4eadc5f 9564219c
  e8d6db35 b47ccfd2 e4a7e748 49286841 98e6971e 09d5ced3 b58314c9 a5660717
  c746af8b 7f42259d c68791c2 1091fed6 a48dbfa1 f36e7b7f e15f9e68 c9e8a5ef
  3251402b f916ffdc 875dc79f e579e1a1 d5bdfa73 59c2ca4c 07ed6052 95c7bb44
  e3eb2568 335bf1be eac51dac ff621b27 ed17fb4a 4ba81fda 7afe862c 240708ad
  6b408fa5 c5dc8dc3 00000005 e0293d06 e1ad683a d757fe8c 906c46e5 57d4c196
  28364cc0 9899c976 97f451fa b218dea7 8346e0ba ac731e33 f22fe31c 84a8e585
  f7f8dbe6 1ea8ca4e 6696c73f 7b8f1969 a093b36c 7722d26f b83bae1b 5336a7ff
  b7549767 41e26651 a12c5cde 34154a68 88663b34 d6c35bb9 c089b847 584f3401
  0765fabf de306f6b 4588d78e 4ba0bf8e 31b04d42 3fbbccda 8eda7df7 121223e0
  bb13c50f 8da186ff b2db269e
Verify (alias: sec-lms-def0cc, time: 0.013): true

    This exhausts the second use of the card.

  10. Check how many signatures remain.

    After signing 16 times, there should be no signatures left.

    ./pipsqueak showinfo alias=sec-lms-def0cc

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
  7852-268D-3BF9
  5F08-02E0-D947
  - Slot 2: ic=13 lms
Alias: sec-lms-def0cc
Algorithm: LMS
 sha256_m32_h5 sha256_n32_w8
  Remaining: 0 signatures
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35

    If you try to sign again, you will get an error.

    ./pipsqueak alias=sec-lms-def0cc message=test

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Public key (alias: sec-lms-def0cc):
  00000005 00000004 63b057b9 575d3dc3 639b85b9 d2533fad 1ef37030 8b8688f7
  02f44fc2 9c697464 9d28ea08 6f172909 04c0aa8a 9ca20d35
2026-02-24T11:28:02 dispatch_see_nvmemfile[dispatch.c:837] NotAvailable(73): no HSMs with NVRAM 6c6d731e:f370308b:8688f7 file
ERROR: sign failed

  11. Attempt to provision an nShield HSM again.

    This time, you should get an error because the card has run out of leases. You can no longer use the key.

    ./pipsqueak provesn=5F08-02E0-D947 slot=2

PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1, 5F08-02E0-D947: 1.4.1)
Attempting to provision 5F08-02E0-D947 from slot 2...
2026-02-24T16:18:03 command_see_provisionLMS[see-commands.c:785] UseLimitExceeded(7): no leases remaining on card in command_see_provisionLMS
ERROR: provisionLMS command failed